A study guide for SEC542: Web App Penetration Testing and Ethical Hacking. Visit the SEC542 webpage For additional information.
- Appendix of concepts, methods and tools in the SEC542 course.
- Cheatsheets for quick reference.
- Glossary of terms in the SEC542 course.
- Index of references to terms in the SEC542 course.
- Labs in the SEC542 course, abridged versions.
- 542.1 Introduction and Information Gathering
- Why the Web
- Understanding the Web
- Course Logistics
- Web App Pen Tester's Toolkit
- Interception Proxies
- WHOIS and DNS
- Exercise: DNS Harvesting
- Open Source Information
- HTTP Protocol
- HTTP Methods
- HTTP Status Codes
- WebSocket
- Exercise: Examining HTTP Requests and Responses
- HTTPS
- Testing for Weak Ciphers
- Exercise: Testing HTTPS
- Heartbleed
- Exercise: Exploiting Heartbleed
- Demo: Burp Suite Introduction
- 542.2 Configuration, Identity and Authentication Testing
- Scanning with Nmap
- Exercise: Gathering Server Info
- Testing Software Configuration
- Shellshock
- Exercise: Shellshock
- Spidering Web Applications
- Exercise: Spidering
- Analyzing Spidering Results
- Exercise: ZAP Forced Browse
- Fuzzing
- Exercise: Burp Fuzzing
- Information Leakage
- Exercise: Directory Browsing
- Authentication
- Exercise: Authentication
- Username Harvesting
- Exercise: Username Harvesting
- 542.3 Injection
- Session Tracking
- Session Fixation
- Bypass Flaws
- Exercise: Authentication Bypass
- Vulnerable Web Apps: Mutillidae
- Command Injection
- Exercise: Command Injection
- File Inclusion and Directory Traversal
- Exercise: Local/Remote File Inclusion
- SQL Injection Primer
- Discovering SQLi
- Exercise: Error-Based SQLi
- Exploiting SQLi
- SQLi Tools
- Exercise: sqlmap + ZAP
- 542.4 JavaScript and XSS
- 542.5 CSRF, Logic Flaws and Advanced Tools
- 542.1 Introduction and Information Gathering
- Outline of the SEC542 course.
- Cheatsheets for quick reference of the SEC542 course.
Study Guide: Outline, Index, Labs, Glossary, Appendix or Cheatsheets.